You are viewing a plain text version of this content. The canonical link for it is here.
Posted to gitbox@hive.apache.org by "KiranVelumuri (via GitHub)" <gi...@apache.org> on 2024/09/03 12:37:11 UTC
[PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
KiranVelumuri opened a new pull request, #5430:
URL: https://github.com/apache/hive/pull/5430
<!--
Thanks for sending a pull request! Here are some tips for you:
1. If this is your first time, please read our contributor guidelines: https://cwiki.apache.org/confluence/display/Hive/HowToContribute
2. Ensure that you have created an issue on the Hive project JIRA: https://issues.apache.org/jira/projects/HIVE/summary
3. Ensure you have added or run the appropriate tests for your PR:
4. If the PR is unfinished, add '[WIP]' in your PR title, e.g., '[WIP]HIVE-XXXXX: Your PR title ...'.
5. Be sure to keep the PR description updated to reflect all changes.
6. Please write your PR title to summarize what this PR proposes.
7. If possible, provide a concise example to reproduce the issue for a faster review.
-->
### What changes were proposed in this pull request?
<!--
Please clarify what changes you are proposing. The purpose of this section is to outline the changes and how this PR fixes the issue.
If possible, please consider writing useful notes for better and faster reviews in your PR. See the examples below.
1. If you refactor some codes with changing classes, showing the class hierarchy will help reviewers.
2. If you fix some SQL features, you can provide some references of other DBMSes.
3. If there is design documentation, please add the link.
4. If there is a discussion in the mailing list, please add the link.
-->
https://issues.apache.org/jira/browse/HIVE-28496
Upgrade vis.js from 4.20.0 to address CVE-2020-28487
### Why are the changes needed?
<!--
Please clarify why the changes are needed. For instance,
1. If you propose a new API, clarify the use case for a new API.
2. If you fix a bug, you can clarify why it is a bug.
-->
To address CVE-2020-28487
### Does this PR introduce _any_ user-facing change?
<!--
Note that it means *any* user-facing change including all aspects such as the documentation fix.
If yes, please clarify the previous behavior and the change this PR proposes - provide the console output, description, screenshot and/or a reproducable example to show the behavior difference if possible.
If possible, please also clarify if this is a user-facing change compared to the released Hive versions or within the unreleased branches such as master.
If no, write 'No'.
-->
Yes. Please see the next comment for screenshots.
### Is the change a dependency upgrade?
<!--
If yes, please attach a file with output from mvn dependency:tree to validate a complete upgrade of dependency.
If no, write 'No'.
-->
Yes. Not attaching the dependency tree output since this does not show up
### How was this patch tested?
<!--
If tests were added, say they were added here. Please make sure to add some test cases that check the changes thoroughly including negative and positive cases if possible.
If it was tested in a way different from regular unit tests, please clarify how you tested step by step, ideally copy and paste-able, so that other reviewers can test and check, and descendants can verify in the future.
If tests were not added, please describe why they were not added and/or why it was difficult to add.
-->
Using the HTML generated from the template file [QueryProfileTmpl.jamon](https://github.com/apache/hive/blob/master/service/src/jamon/org/apache/hive/tmpl/QueryProfileTmpl.jamon) in the checkWebuiShowGraph test from [TestQueryDisplay.java](https://github.com/apache/hive/blob/master/itests/hive-unit/src/test/java/org/apache/hive/service/cli/session/TestQueryDisplay.java#L164C15-L164C34)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "KiranVelumuri (via GitHub)" <gi...@apache.org>.
KiranVelumuri commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2354677822
Both [Apache Hive](https://github.com/apache/hive/blob/master/LICENSE) and [vis.js](https://github.com/visjs/vis-network/blob/master/LICENSE-APACHE-2.0) are licensed under Apache License 2.0. In [Applying the Apache license, version 2.0](https://www.apache.org/legal/apply-license.html#:~:text=Each%20original%20source%20document%20(code%20and%20documentation%2C%20but%20not%20the%20LICENSE%20and%20NOTICE%20files)%20should%20include%20a%20short%20license%20header%20at%20the%20top.), it is mentioned that each source file must include a header.
@okumin @zhangbutao
So, we should add the Apache LICENSE 2.0 header at the top of vis-network.min.js to comply with the standards. Please reply/react so that I will apply the header to the current change and update the commit.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "KiranVelumuri (via GitHub)" <gi...@apache.org>.
KiranVelumuri commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2338438148
/build
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "KiranVelumuri (via GitHub)" <gi...@apache.org>.
KiranVelumuri commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2340867068
force pushed now to retrigger Jenkins, no changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "KiranVelumuri (via GitHub)" <gi...@apache.org>.
KiranVelumuri commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2348198056
> I approved. I would like someone to check the license point as well.
@ayushtkn Could you please comment on the license point? Thank you.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2326703591
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "zabetak (via GitHub)" <gi...@apache.org>.
zabetak commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2371331629
@okumin Good catch! I haven't noticed that portions of the file (L44-49) are licensed differently. Yes, we need to handle such cases carefully especially when we are dealing with licenses that are not in [category-a](https://www.apache.org/legal/resolved.html#category-a). Since it seems that portion of the file is only under the MIT license then we should include both a copy of the [license](https://github.com/naver/hammer.js/blob/master/LICENSE.md) in our source code distribution and an appropriate entry in our main LICENSE file.
In general, whenever there is a doubt about how to handle a licensing case, the correct reaction is to contact the Apache legal team (e.g., by opening a LEGAL jira ticket) and request guidance.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "okumin (via GitHub)" <gi...@apache.org>.
okumin commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2379064065
I confirmed it would also work on my machine
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2329759300
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "KiranVelumuri (via GitHub)" <gi...@apache.org>.
KiranVelumuri commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2331209418
@okumin @zhangbutao
Could you please review this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "KiranVelumuri (via GitHub)" <gi...@apache.org>.
KiranVelumuri commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2331871070
> You said this pr introduced user-facing change, but i don't see any difference from the screenshots you provided.
Yes, they are identical even after the library upgrade. I meant in the sense that this change is at the user-facing end. Updated the comment now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "okumin (via GitHub)" <gi...@apache.org>.
okumin commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2355896634
I assume you are not an author of vis.js, and the rule is unlikely applied if I undeistand correctly.
https://www.apache.org/legal/src-headers.html#3party
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2377569595
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "KiranVelumuri (via GitHub)" <gi...@apache.org>.
KiranVelumuri commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2367824147
@zabetak Thank you, we will proceed as is.
@okumin @zhangbutao I think no further changes are needed, please help in merging. Thank you.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "okumin (via GitHub)" <gi...@apache.org>.
okumin commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2338352468
Thanks. I verified the content of 55ca3d83690154dcb598450dbd02319491f91bcd is precisely the same as that in the internet.
```
$ shasum service/src/resources/hive-webapps/static/js/vis-network.min.js
021306dceabc3358057f91b84c7dbbe6f48ac12e service/src/resources/hive-webapps/static/js/vis-network.min.js
$ shasum /tmp/vis/unpkg.js
021306dceabc3358057f91b84c7dbbe6f48ac12e /tmp/vis/unpkg.js
$ diff service/src/resources/hive-webapps/static/js/vis-network.min.js /tmp/vis/unpkg.js
$
```
I also confirmed the revision is likely to work in the same way as 4.0.0.
Configuration I used.
```
<property>
<name>hive.server2.webui.explain.output</name>
<value>true</value>
</property>
<property>
<name>hive.server2.webui.show.graph</name>
<value>true</value>
</property>
```
CI failed but I believe it is unrelated.
https://ci.hive.apache.org/blue/rest/organizations/jenkins/pipelines/hive-precommit/branches/PR-5430/runs/3/nodes/455/log/?start=0
As for the license, the MIT part about `Hammer.JS` shall be mentioned here? To be honest, I am not confident with the rule.
https://github.com/apache/hive/blob/master/LICENSE
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "zhangbutao (via GitHub)" <gi...@apache.org>.
zhangbutao merged PR #5430:
URL: https://github.com/apache/hive/pull/5430
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "zhangbutao (via GitHub)" <gi...@apache.org>.
zhangbutao commented on code in PR #5430:
URL: https://github.com/apache/hive/pull/5430#discussion_r1778088554
##########
service/src/jamon/org/apache/hive/tmpl/QueryProfileTmpl.jamon:
##########
@@ -57,7 +57,7 @@ private boolean showStats = false;
</%if>
</%if>
<%if showGraph %>
- <script type="text/javascript" src="/static/js/vis.min.js"></script>
+ <script type="text/javascript" src="/static/js/vis-network.min.js"></script>
Review Comment:
I'm not very clear about license. But the latest change is good to me. :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "KiranVelumuri (via GitHub)" <gi...@apache.org>.
KiranVelumuri commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2334362258
Thank you @zhangbutao for the review!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "okumin (via GitHub)" <gi...@apache.org>.
okumin commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2371036811
@zabetak Just a question from my curiosity. [L44- of the file is not licensed as AL2](https://github.com/apache/hive/blob/49f66c20e1f29afcd3570a401d8df67b0b186e5c/service/src/resources/hive-webapps/static/js/vis-network.min.js#L44-L51), as it is MIT. Don't we need special care in this case? Additionally, if it was GPL or something, would we have to take care of it?
I think Butao can merge this PR as a committer.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "zabetak (via GitHub)" <gi...@apache.org>.
zabetak commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2367777087
When we include code not owned by the contributor it is best to leave the file as it is (no modifications).
Since the file is not developed by us it may be nice to add a mention in LICENSE although not strictly necessary since it is licensed under AL2.
More general, it is best to avoid minified javascript files in Apache source releases but this is a bit of a grey area so we can continue as is for the moment.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2342669925
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "zhangbutao (via GitHub)" <gi...@apache.org>.
zhangbutao commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2331836193
> Does this PR introduce any user-facing change?
> Yes. Please see the next comment for screenshots.
You said this pr introduced user-facing change, but i don't see any difference from the screenshots you proveided.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "okumin (via GitHub)" <gi...@apache.org>.
okumin commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2336720439
I am checking the content on CDN and that on this PR.
### CDN
```
% curl -o unpkg.js https://unpkg.com/vis-network@9.1.9/standalone/umd/vis-network.min.js
% shasum unpkg.js
021306dceabc3358057f91b84c7dbbe6f48ac12e unpkg.js
```
### This PR
The checksum didn't match.
```
% shasum service/src/resources/hive-webapps/static/js/vis-network.min.js
173617cf2974080c9857f949ddeb424b50410c87 service/src/resources/hive-webapps/static/js/vis-network.min.js
```
The diff is too big to put here.
```
% diff service/src/resources/hive-webapps/static/js/vis-network.min.js /tmp/vis/unpkg.js
```
I have some questions.
- Is it legal to add the Apache 2.0 header on our own? Looks like, the file includes [a part with dual licenses of Apache 2.0 and MIT](https://github.com/apache/hive/blob/49f66c20e1f29afcd3570a401d8df67b0b186e5c/service/src/resources/hive-webapps/static/js/vis-network.min.js#L18-L42), and [a part with MIT](https://github.com/apache/hive/blob/49f66c20e1f29afcd3570a401d8df67b0b186e5c/service/src/resources/hive-webapps/static/js/vis-network.min.js#L44-L49). I am not confident that our manner is acceptable
- Could you please create `vis-network.min.js` so that it is exactly(or + Apache 2.0 header) the same as the file on the CDN? We have to ensure the new file is definitely safe, but it is hard to review a minified JS codes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "KiranVelumuri (via GitHub)" <gi...@apache.org>.
KiranVelumuri commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2326423594
Link to resource vis-network.min.js from [vis.js](https://visjs.org/) library:
[vis-network.min.js](https://unpkg.com/browse/vis-network@9.1.9/standalone/umd/vis-network.min.js)
## Before (with vis.min.js):
<img width="1235" alt="image" src="https://github.com/user-attachments/assets/5590da3e-0820-4eea-8673-004f11c88f94">
<img width="1231" alt="image" src="https://github.com/user-attachments/assets/a2839a6c-55ff-4359-bc45-6ac1184852ac">
<img width="1317" alt="image" src="https://github.com/user-attachments/assets/fbaff694-afb5-4c47-b41d-1a298e2f329d">
## After (with vis-network.min.js):
<img width="1255" alt="image" src="https://github.com/user-attachments/assets/d469e850-89ff-436b-a9d4-d3f11d3e913e">
<img width="1219" alt="image" src="https://github.com/user-attachments/assets/377e4597-f2e3-4a9c-b33d-4007235ad172">
<img width="1209" alt="image" src="https://github.com/user-attachments/assets/39a8fca0-8488-4d38-9d2c-5e857db1da8a">
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "KiranVelumuri (via GitHub)" <gi...@apache.org>.
KiranVelumuri commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2367699048
> I approved. I would like someone to check the license point as well.
@zabetak Could you please comment on the license point? Thank you.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2337566576
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430) **Quality Gate passed**
Issues
 [6 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "KiranVelumuri (via GitHub)" <gi...@apache.org>.
KiranVelumuri commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2337532568
> Thanks! The motivation looks good to me.
>
> I am checking the content on CDN and that on this PR.
>
> ### CDN
> ```
> % curl -o unpkg.js https://unpkg.com/vis-network@9.1.9/standalone/umd/vis-network.min.js
> % shasum unpkg.js
> 021306dceabc3358057f91b84c7dbbe6f48ac12e unpkg.js
> ```
>
> ### This PR
> The checksum didn't match.
>
> ```
> % shasum service/src/resources/hive-webapps/static/js/vis-network.min.js
> 173617cf2974080c9857f949ddeb424b50410c87 service/src/resources/hive-webapps/static/js/vis-network.min.js
> ```
>
> The diff is too big to put here.
>
> ```
> % diff service/src/resources/hive-webapps/static/js/vis-network.min.js /tmp/vis/unpkg.js
> ```
>
> I have some questions.
>
> * Is it legal to add the Apache 2.0 header on our own? Looks like, the file includes [a part with dual licenses of Apache 2.0 and MIT](https://github.com/apache/hive/blob/49f66c20e1f29afcd3570a401d8df67b0b186e5c/service/src/resources/hive-webapps/static/js/vis-network.min.js#L18-L42), and [a part with MIT](https://github.com/apache/hive/blob/49f66c20e1f29afcd3570a401d8df67b0b186e5c/service/src/resources/hive-webapps/static/js/vis-network.min.js#L44-L49). I am not confident that our manner is acceptable
> * Could you please create `vis-network.min.js` so that it is exactly(or + Apache 2.0 header) the same as the file on the CDN? We have to ensure the new file is definitely safe, but it is hard to review a minified JS codes
Thank you for the review.
- I have updated the file `vis-network.min.js` to be the same as from the CDN.
shasum - 021306dceabc3358057f91b84c7dbbe6f48ac12e
- About the licensing part, I have added the license following from earlier file `vis.min.js`, and yes I think it's better to keep the license and the file as is from the CDN. Also, not having the license header should be okay as it is mentioned `vis.js may be distributed under either license.`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2341538347
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "zabetak (via GitHub)" <gi...@apache.org>.
zabetak commented on code in PR #5430:
URL: https://github.com/apache/hive/pull/5430#discussion_r1773405520
##########
service/src/jamon/org/apache/hive/tmpl/QueryProfileTmpl.jamon:
##########
@@ -57,7 +57,7 @@ private boolean showStats = false;
</%if>
</%if>
<%if showGraph %>
- <script type="text/javascript" src="/static/js/vis.min.js"></script>
+ <script type="text/javascript" src="/static/js/vis-network.min.js"></script>
Review Comment:
Do we need to include the `vis-network.min.js` file in our source and binary distribution? Can't we simply link to it without copying its source code in this repo?
```
<script type="text/javascript" src="https://unpkg.com/vis-network@9.1.9/standalone/umd/vis-network.min.js"></script>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "zabetak (via GitHub)" <gi...@apache.org>.
zabetak commented on code in PR #5430:
URL: https://github.com/apache/hive/pull/5430#discussion_r1774787542
##########
service/src/jamon/org/apache/hive/tmpl/QueryProfileTmpl.jamon:
##########
@@ -57,7 +57,7 @@ private boolean showStats = false;
</%if>
</%if>
<%if showGraph %>
- <script type="text/javascript" src="/static/js/vis.min.js"></script>
+ <script type="text/javascript" src="/static/js/vis-network.min.js"></script>
Review Comment:
I don't know the history behind the original decision to bundle it inside but for me this approach is better in every aspect.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "KiranVelumuri (via GitHub)" <gi...@apache.org>.
KiranVelumuri commented on code in PR #5430:
URL: https://github.com/apache/hive/pull/5430#discussion_r1774515964
##########
service/src/jamon/org/apache/hive/tmpl/QueryProfileTmpl.jamon:
##########
@@ -57,7 +57,7 @@ private boolean showStats = false;
</%if>
</%if>
<%if showGraph %>
- <script type="text/javascript" src="/static/js/vis.min.js"></script>
+ <script type="text/javascript" src="/static/js/vis-network.min.js"></script>
Review Comment:
I included the file to follow the same manner as earlier.
Yes, we can have it this way as well. I have validated with this way of `src` and it works fine. Please let me know if we can proceed this way to circumvent the license issue.
<img width="1224" alt="image" src="https://github.com/user-attachments/assets/5e69fe3c-82e6-46f1-bc86-3d909b93aba7">
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "KiranVelumuri (via GitHub)" <gi...@apache.org>.
KiranVelumuri commented on code in PR #5430:
URL: https://github.com/apache/hive/pull/5430#discussion_r1774515964
##########
service/src/jamon/org/apache/hive/tmpl/QueryProfileTmpl.jamon:
##########
@@ -57,7 +57,7 @@ private boolean showStats = false;
</%if>
</%if>
<%if showGraph %>
- <script type="text/javascript" src="/static/js/vis.min.js"></script>
+ <script type="text/javascript" src="/static/js/vis-network.min.js"></script>
Review Comment:
I included the file to follow the same manner as earlier.
Yes, we can have it this way as well. I have validated with this way of `src` and it works fine. Please let me know if we can proceed this way.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28496: Address CVE-2020-28487 due to 4.20.0 version of vis.js [hive]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #5430:
URL: https://github.com/apache/hive/pull/5430#issuecomment-2376778317
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5430&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=5430&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5430&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5430)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org